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Top Stories 

• Federal authorities sued the owners of North Dakota Developments LLC May 5 for 
allegedly raising over $62 million in a Ponzi scheme that defrauded U.S. and European 
investors by selling stakes in short-term housing projects for oil workers in the Bakken oil 
field region of North Dakota and Montana. - Reuters (See item 4) 

• The Minnesota Board of Animal Health reported May 4 that eight additional farms across 



the State are believed to have been hit by the H5N2 avian flu, including a 1.1 million hen 
flock at an egg-laying operation in Nicollet County. - Minneapolis Star Tribune (See item 



• Federal officials are reviewing an updated version of Hospira LifeCare PCA that addresses 
several vulnerabilities in the devices which could allow remote attackers to access 
configuration settings, software updates, and drug libraries. - Securityweek (See item 12) 

• A 4-alarm fire at the Brookside Condominium Complex in Arlington, Massachusetts, May 
5 left 1 person dead and resulted in damage to 36 units. - WFXT 25 Boston (See item 22) 
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Energy Sector 

See item 4 
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Chemical Industry Sector 

See item 7 
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Nuclear Reactors, Materials, and Waste Sector 

1. May 5, Kennewick Tri-City Herald - (Washington) Richland nuclear plant refueling 
outage starts May 9. Energy Northwest officials reported that the Columbia 
Generating Station in Richland, Washington, will shut down May 9 for 42 days of 
scheduled refueling and maintenance. Crews plan to replace 248 of the plant’s nuclear 
fuel assemblies, install an improved system for measuring reactor power, and install 3 
new 175-ton power transformers, as well as other small maintenance projects during 
the outage. 

Source: http://www.tri- 

cityherald.com/welcome page/?shf=/2015/05/05/3546020 richland-nuclear-plant- 
refueling.html 
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Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

2. May 6, Softpedia - (International) Tinba banking trojan checks for sandbox before 

launching. Security researchers from F-Secure discovered a new variant of the Tiny 
Banker (Tinba) trojan, which checks for mouse movement and the active window a 
user is working on to ensure that it is executed on a real machine and not a sandbox 
before running its malicious routines. The trojan also queries the number of cylinders 
available to the system’s storage device to determine if it is a virtual machine. 
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Source: http://news.softpedia.com/news/Tinba-Banking-Trojan-Checks-For-Sandbox- 
Before-Launching-480314.shtml 



3. May 5, U.S. Department of Justice - (National) Ripple Labs Inc. resolves criminal 
investigation. The U.S. Treasury Department Financial Crimes Enforcement Network 
(FinCEN) in conjunction with the U.S. Attorney’s Office of the Northern District of 
California assessed a $700,000 penalty against San Francisco-based Ripple Labs Inc., 
and its subsidiary, XRP II, LLC May 5, for willful violations of the Bank Secrecy Act. 
Violations include selling virtual currency without registering with FinCEN, and failing 
to implement and maintain an adequate anti-money laundering program. 

Source: http://www.iustice.gov/opa/pr/ripple-labs-inc-resolves-criminal-investigation 

4. May 5, Reuters - (International) SEC lawsuit alleges Ponzi scheme over North 
Dakota ‘man camps.’ The U.S. Securities and Exchange Commission (SEC) sued 
North Dakota Developments LLC and its three owners May 5, for an alleged fraud and 
Ponzi scheme in which the suspects illegally raised over $62 million from hundreds of 
investors in at least 12 States and multiple European countries since 2012 by selling 
stakes in 4 short-term housing projects for oil workers in the Bakken oil field region in 
North Dakota and Montana, known as “man camps.” The SEC claimed that the trio 
paid investors from other invested funds and misappropriated over $25 million for 
hidden broker commissions, payment to themselves, and investment in other Bakken 
projects. 

Source: http://www.reuters.com/article/2015/05/05/sec-northdakotadevelopments- 
mancamps-idUSLlN0XW3BH20150505 
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Transportation Systems Sector 

5. May 5, Reuters - (New York) New York man pleads guilty to shining laser at 
LaGuardia pilots. A New York City man pleaded guilty May 5 to pointing a laser 
beam into the eyes of the pilots of three commercial planes at LaGuardia Airport in 
New York March 9, temporarily blinding the pilots and causing an air traffic controller 
to change runway directions for arriving and departing planes. The suspect also aimed 
the laser beam at a New York Police Department helicopter that was dispatched to the 
Bronx borough during the investigation. 

Source: http://www.reuters.com/article/2015/05/05/usa-crime-laser- 
idUSLlN0XW3QD201 50505 
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Food and Agriculture Sector 

6. May 6, Associated Press - (Iowa) Iowa bird flu cases increase by 3 to 28. Agriculture 
officials confirmed May 6 the presence of the H5N2 avian flu at 3 additional Iowa 
poultry farms, raising the total number of cases in the State to 28 across 1 1 counties. 
More than 20 million birds in the State are believed to have been affected by the virus. 
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Source: http://www.wxow.com/story/28991081/iowa-bird-flu-cases-increase-bv-3-to- 
28 

7. May 6, U.S. Environmental Protection Agency - (Kansas) EPA identifies misbranded 
pesticide at Kansas City, Kan., pesticide distributor. The U.S. Environmental 
Protection Agency reported May 5 that Auto-Chlor System, LLC agreed to pay a 
$6,750 penalty to resolve charges that the pesticide registrant and distributor violated 
the Federal Insecticide, Fungicide and Rodenticide Act by selling or distributing a 
misbranded pesticide at a dealer facility in Kansas City, Kansas. A January 2014 
inspection by the Kansas Department of Agriculture found that the pesticide lacked the 
required directions for safe and proper storage and disposal. 

Source: 

http://vosemite.epa.gov/opa/admpress.nsf/21b8983ffa5d0e4685257dd4006b85e2/la6ae 

Ied5045030585257e3c00774e9d 

8. May 5, Minneapolis Star Tribune - (Minnesota) Minnesota farm with 1.1 million 
hens, largest yet, gets bird flu. The Minnesota Board of Animal Health reported May 
4 that eight additional farms across the State are believed to have been hit by the H5N2 
avian flu, including a 1 . 1 million hen flock at an egg-laying operation in Nicollet 
County. More than 5.34 million birds across 80 farms in the State have been affected. 
Source: http://www.startribune.com/business/30247073 1 .html 

9. May 4, WITI 6 Milwaukee - (Wisconsin) 10 total cases in Wisconsin: Bird flu 
detected on two more farms in Barron, Jefferson counties. The Wisconsin 
Department of Agriculture, Trade, and Consumer Protection confirmed May 4 the 
presence of H5 avian flu at two additional poultry farms in Jefferson and Barron 
counties. The estimated 142,570 affected birds will be quarantined and culled as a 
precaution. 

Source: http://fox6now.com/2015/05/04/10-total-cases-in-wisconsin-bird-flu-detected- 
on-two-more-farms-in-barron-jefferson-counties/ 
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Water and Wastewater Systems Sector 

10. May 6, WTTG 5 Washington, D.C. - (Maryland) 10,000 gallons of raw sewage 
estimated to have leaked into Prince George’s neighborhood. The Washington 
Suburban Sanity Commission reported May 6 that a leak on a 14-inch sewer main 
caused over 10,000 gallons of raw sewage to spill into a Prince George’s County 
neighborhood following the leak’s discovery May 3. Crews worked to repair the 
damaged section of the pipe and officials posted signs around Oxon Run after 
determining that some of the wastewater reached the area. 

Source: http://www.mvfoxdc.com/storv/28990215/10000-gallons-of-raw-sewage- 
estimated-to-have-leaked-into-prince-georges-neighborhood 

11. May 5, KHON 2 Honolulu - (Hawaii) Sewage overflows from Wailua wastewater 
treatment plant. Workers placed warning signs and disinfected the affected area after 
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approximately 10,000 gallons of treated and disinfected sewage spilled from the 
Wailua wastewater treatment plant in Kauai May 5 and reached an area near the 
Lydgate Beach Park. The spill originated from an onsite manhole due to a partial 
blockage of the sewer line. 

Source: http://khon2.com/2015/05/05/sewage-overflows-from-wailua-wastewater- 
treatment-plant/ 
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Healthcare and Public Health Sector 

12. May 6, Securityweek- (National) Serious security flaws found in Hospira LifeCare 
drug pumps. The U.S. Industrial Control Systems Cyber Emergency Response Team 
(ICS -CERT) published an advisory based on a Canadian researcher’s findings that 
detailed several security issues in Hospira LifeCare PCA3 drug infusion pumps, 
including an improper authorization issue and insufficient verification of data 
authenticity which can be exploited by a remote attacker to upload drug libraries, 
configuration changes, and software updates. The company developed LifeCare PCA 
infusion system version 7.0 addressing the vulnerabilities, which is currently under 
review by the U.S. Food and Drug Administration. 

Source: http://www.securitvweek.com/serious-securitv-flaws-found-hospira-lifec are- 
drug-pumps 

13. May 5, WTVJ 6 Miami - (Florida) Gas leak forces partial evacuation of South 
Miami Hospital. A May 5 gas leak prompted the first floor of South Miami Hospital in 
Florida to evacuate for more than 3 hours after construction crews inadvertently hit a 
gas line. The break was repaired while evening classes at the hospital were canceled 
and patients being transported by ambulance to the emergency room were taken to 
neighboring hospitals. 

Source: http://www.nbcmiami.com/news/local/Gas-Leak-Forces-Partial-Evacuation-of- 
South-Miami-Hospital-3026 18241 .html 
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Government Facilities Sector 



14. May 6, U.S. Environmental Protection Agency - (Virginia) Navy settles 

environmental violations at Naval Station Norfolk. The U.S. Environmental 
Protection Agency reached a settlement May 6 with the U.S. Navy addressing Clean 
Air Act and Resource Conservation and Recovery Act violations at the Naval Station 
Norfolk in Virginia after the facility violated emissions limits, had recordkeeping 
violations, and did not perform leak rate calculations of ozone-depleting substances 
when it serviced air conditioning units. Proposed penalties total $83,900 and the U.S. 
Navy will implement improved training and recordkeeping procedures. 

Source: 

http://vosemite.epa.gOv/opa/admpress.nsf/0/cl5c54318584311685257e3d004ba84e 
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15. May 6, WABC 7 New York City - (New York) Ulster County forest fire may take 
several more days to put out. Crews reached 80 percent containment May 6 of a 
wildfire that burned over 2,000 acres in Ulster and Sullivan counties in New York. 
Source: http://7online.com/news/forest-fire-in-ulster-county-mav-take-several-more- 
davs-to-put-out/696406/ 

16. May 5, Battle Creek Enquirer - (Michigan) After bomb threat, special needs kids 
evacuated. Students and staff from Doris Klaussen Developmental Center in Emmett 
Township were evacuated for at least 3 hours May 5 due to a phoned bomb threat. 
Authorities reported that the evacuation was precautionary and no one was believed to 
be in danger. 

Source: http://www.battlecreekenquirer.com/story/news/local/2015/05/05/bomb-threat- 
leads-evacuation-doris-klaussen-center/26925973/ 
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Emergency Services Sector 

17. May 6, Associated Press - (Idaho; Washington) Police: Idaho officer shot by man 
who stole patrol car dies. A northern Idaho police officer died from injuries after 
being shot by a suspect while responding to a call about a suspicious person in a Coeur 
d’Alene neighborhood May 5. The suspect stole the officer’s patrol car and led police 
on a high-speed chase before he was arrested in Post Falls. 

Source: http://www.timesleaderonline.com/page/content.detail/id/842416/Police— 
Idaho-officer-shot-bv-man-who-stole-patrol-car-dies.html?isap=l&nav=5021 
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Information Technology Sector 

See item 2 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

18. May 6, Keokuk Daily Gate City - (Iowa) Century Uink service could be restored 
after midnight tonight. Telephone, some cell phone and Internet services for 
CenturyLink customers in Burlington, Fort Madison, and Keokuk were down after a 
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CenturyLink fiber was cut May 5. Crews worked to restore services by May 6. 
Source: http://www.dailygate.com/news/article d4b78804-f380-l Ie4-b413- 
f3a8a7ffl6f5.html 



19. May 5, Marin Independent Journal - (California) San Rafael AT&T service 

disruption continuous for second day after Terra Linda crash. Crews worked May 
5 to restore Internet and phone services to the remaining AT&T customers in San 
Rafael impacted by an outage caused by an alleged drunk driver that crashed into 
AT&T vaults at an intersection in Terra I. inda May 3. 

Source: http://www.marinii.com/general-news/20150504/san-rafael-att-service- 
disruption-continues-for-second-day-after-terra-linda-crash 
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Commercial Facilities Sector 

20. May 6, Orange County Register - (California) Cypress apartment fire displaces up 
to 200, burns cars and damages building. About 175 - 200 residents were 
temporarily displaced from the Cypress Garden Apartments in Orange County, 
California, following a 2-alarm fire May 5 that prompted officials to cut off power to 
the building and caused an estimated $700,000 in damage to the structure and its 
contents. Power was expected to be restored May 6, while the blaze remains under 
investigation. 

Source: http://www.ocregister.com/articles/fire-660737-concialdi-cars.html 

21. May 6, Baton Rouge Advocate; KATC 3 Lafayette - (Louisiana) Lafayette apartment 
evacuated, police find explosive devices, weapons. The Bell Downs apartment 
complex in Lafayette was evacuated for several hours May 5 after police found 
explosive devices among a large collection of weapons while searching the home of a 
man suspected of illegally discharging a firearm May 4. Authorities treated the items as 
live explosives and worked to remove the devices from the complex while the suspect 
was taken into custody. 

Source: http://theadvocate.com/news/12292503-123/lafavette-apartment-evacuated- 
police-find 

22. May 5, WFXT 25 Boston - (Massachusetts) 1 person killed in 4-alarm fire at 
Arlington condo complex. A 4-alarm fire at the Brookside Condominium Complex in 
Arlington, Massachusetts, May 5 left 1 person dead and resulted in damage to 36 units. 
Officials believe the blaze was sparked by the improper disposal of smoking materials 
in mulch that was placed closer to the building than allowed by law. 

Source: http://www.mvfoxboston.com/story/28977699/4-alarm-fire-breaks-out-at- 
arlington-complex 

23. May 3, KDKA 2 Pittsburgh - (Pennsylvania) Fire causes $1 mil in damage at 
apartment building. The Brentmoor at Penn Center apartment building in Wil ki ns 
Township suffered an estimated $1 million in damage from a May 2 fire that is 
believed to have been sparked by a faulty power cord. Several individuals were 
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transported to an area hospital, while dozens of residents were safely evacuated. 
Source: httD://Dittsburgh.cbslocal.com/2015/05/03/fire-causes-l-mil-in-damage-at- 
apartment-building/ 



Dams Sector 

Nothing to report 
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NTAS 

A^viwfT 

NO ACTIVE ALERTS 
www.DHS.gov/alerts 



Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support @ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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